AIGroup Markdown to Word MCP

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:18 AM UTC
• Version: 0.1.2

Overview

The skill is a focused Markdown-to-Word converter, but it relies on automatically running an unpinned external MCP package, so users should review that dependency before installing.

Install only if you are comfortable running the external aigroup-mdtoword-mcp package in your agent environment. Prefer pinning an audited version, using a locked or trusted package source, and running it with limited file and network access before processing private documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/capabilities.md:29

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: references/capabilities.md, lines 29–33
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown

## Dependency

- MCP server name: `aigroup-mdtoword-mcp`
- Local launch pattern in this workspace: `npx -y aigroup-mdtoword-mcp`
- Upstream package metadata includes both `stdio` and `http` transports

Technical Analysis

The documented launch pattern invokes npx -y aigroup-mdtoword-mcp without an exact package version, lockfile, or integrity constraint. When the package is not already available in a trusted local cache, npx can resolve and download it from the configured package registry before executing it. The -y option suppresses the installation confirmation.

Because package resolution is mutable, the code executed at runtime may differ from the code originally reviewed. A compromised publisher account, malicious future release, registry compromise, or unsafe registry configuration could therefore introduce attacker-controlled code. The project does not include the MCP server implementation, so its runtime behavior cannot be independently verified from the audited artifact.

Attack Path

1. An attacker compromises the package publisher, registry, or dependency-resolution environment, or publishes a malicious update under the dependency's package identity.
2. A user asks the agent to convert Markdown or structured table data into a Word document.
3. The skill routes the request to aigroup-mdtoword-mcp.
4. The workspace launches the documented npx -y aigroup-mdtoword-mcp command.
5. npx resolves and downloads the current mutable package version without interactive approval.
6. The malicious package executes locally with the privileges and environmental access of the agent process.
7. The package can access resources available to that process, potentially including submitted Markdown, referenced local images, generate ...[truncated 835 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an audited exact version, for example:

   bash

   npx --yes aigroup-mdtoword-mcp@<audited-exact-version>
   

2. Maintain a lockfile containing registry-resolved integrity metadata and enforce immutable or frozen installation behavior in deployment.
3. Prefer preinstalling the reviewed package from a trusted registry or internal artifact repository rather than downloading code at invocation time.
4. Verify package provenance, signatures, checksums, ownership history, and release contents before upgrades.
5. Apply an explicit dependency-update review process so newer releases cannot enter production automatically.
6. Where compatible with the package, disable installation lifecycle scripts or review them before execution.
7. Run the MCP server in a sandbox or container with:
   • A dedicated, unprivileged operating-system identity
   • Read/write access only to required input and output paths
   • No access to unrelated credentials or environment variables
   • Restricted outbound network access
   • Resource and execution-time limits
8. Document the exact approved transport and bind any HTTP transport only to a trusted local interface with authentication where applicable.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables allow_implicit_invocation without any visible trigger constraints, so the agent may auto-select this MCP tool in broader situations than intended. Because the tool can transform user or generated content and likely sends that content to an external stdio-connected service, overly broad activation increases the chance of unintended data exposure, misuse, or surprise document conversion flows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The capability file instructs launching the MCP server with npx -y aigroup-mdtoword-mcp without pinning a specific package version. This makes execution dependent on whatever version is currently published or resolved at install time, creating a supply-chain risk where a malicious, compromised, or breaking upstream release could be pulled and run automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.